Web Security Checklist for Subdomains: Dangling DNS and Headers

Deploying applications on free subdomains is exhilarating, but basic security hygiene is vital to protect your users, authentication tokens, and reputation. Here is the developer security checklist every engineer should review before going live.

1. Guard Against Subdomain Takeover (Dangling CNAMEs)

A subdomain takeover occurs when a DNS record points to an external service (like an S3 bucket, GitHub Pages repo, or Vercel project) that has been deleted or unclaimed. A malicious actor can claim that abandoned project name on the third-party provider and immediately serve content under your trusted domain.

2. Configure Essential HTTP Security Headers

Whether using Nginx, Caddy, or Next.js middleware, always send these HTTP response headers:

# Prevent MIME-type sniffing
X-Content-Type-Options: nosniff

# Clickjacking defense
X-Frame-Options: SAMEORIGIN

# Cross-site scripting filter
X-XSS-Protection: 1; mode=block

# Enforce HTTPS connections
Strict-Transport-Security: max-age=31536000; includeSubDomains

# Control referrer leakage
Referrer-Policy: strict-origin-when-cross-origin

3. Secure Authentication Cookies

If you store authentication JWTs or session identifiers in browser cookies, ensure they are hardened against interception:

• Secure: true — Ensures cookies are only transmitted over encrypted HTTPS.
• HttpOnly: true — Prevents malicious client-side JavaScript from reading sensitive session tokens.
• SameSite: Lax (or Strict) — Protects against Cross-Site Request Forgery (CSRF).